ISMN 5370 Ex2 S8

Risk vs. uncertainty

Specific event with estimable probability and impact (plan for it) vs. vague lack of knowledge with no probability (handle with buffers and adaptability)

Opportunity

Positive uncertain event; logged in the same register as threats

Risk management loop

Identify → Analyze → Plan Responses → Monitor → back to Identify; revisit at every milestone

Risk brainstorming

Most common identification technique; quantity first, judge later, with a facilitator

Risk checklist

Built from past projects; fast but misses new risks; a starting point only

Assumptions analysis

Asking "what if this assumption is wrong?"; unstable assumptions become risks

Best-practice order for identifying risks

Start with checklists, expand with brainstorming, pressure-test with assumptions analysis

Probability-impact matrix

Qualitative tool scoring each risk by likelihood and severity; scales defined up front; high-high needs action now, low-low can be accepted and monitored

Risk register

Living log of each item's description, probability, impact, response, one named owner, and status

Avoid (threat)

Change the plan so the risk can't occur

Transfer (threat)

Shift the impact to a third party (insurance, contracts)

Mitigate (threat)

Reduce probability and/or impact; the most common response

Accept (threat)

Take no proactive action; document and monitor

Exploit (opportunity)

Make sure the opportunity happens

Share (opportunity)

Partner with a third party better able to capture it

Enhance (opportunity)

Increase the opportunity's probability and/or impact

Accept (opportunity)

Don't pursue it, but still document it

Choosing a risk response

Compare response cost to expected loss; consider risk appetite; re-score what's left afterward

Residual risk

Exposure remaining after a response is applied

EMV

Probability × impact, summed across risks; one way to size contingency (others: 5–15% of budget, or expert judgment + historical data)

RAID log

Risks, Assumptions, Issues, Dependencies; each entry needs owner, due date, status; reviewed at kickoff, weekly, at milestones; archived at close

Risk vs. issue

Future and uncertain (plan for it) vs. present and certain (resolve it); a risk that occurs with no plan becomes the latter